CVE-2026-61654— Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

Quick assessment

Affected

lightdash lightdash

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Lightdash 是一个开源商业智能（BI）平台。在受影响版本（0.3213.0 及更早版本）中，dbt Cloud 的 Webhook 接口缺乏身份验证中间件和签名验证机制。在中，函数会从类型的请求中直接获取和，并将这些未经净化的值传递给中的方法。这些未经验证的值被直接拼接到服务端调用的 dbt Cloud API URL 中，随后该请求会使用受害项目的 API 密钥，通过请求头发出。攻击者可通过参数实施路径遍历攻击，从而改变域名下的请求路径，而保持主机名不变。这导致携带凭证的请求被发

CVSS 8.3 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1110 · Brute Force T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

Source: CVE Program / CVE List V5

Vulnerability Description

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
lightdash	lightdash	< 0.3214.0	-

II. Public POCs for CVE-2026-61654

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61654

请登录查看更多情报信息。

Other References for CVE-2026-61654 (4)

https://github.com/lightdash/lightdash/pull/24587 x_refsource_MISC
https://github.com/lightdash/lightdash/releases/tag/0.3214.0 x_refsource_MISC
https://github.com/lightdash/lightdash/security/advisories/GHSA-r4xc-vwqr-3252 x_refsource_CONFIRM
https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61654

IV. Related Vulnerabilities

Same product: lightdash

Same vendor: lightdash

Same weakness: CWE-89